Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022070620220707\index.dat
Modifies the following files
Network activity
Connects to
- 'tu###ideo.eu':80
- 'se##top.eu':80
- 'po##otop.eu':80
- 'sh###per.org':80
- 'po###tube.eu':80
- 'a.###lsrv.com':443
- 'fo###.#oogleapis.com':80
- 'fo###.gstatic.com':80
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://tu###ideo.eu/yapwoy.cgi?2&###################################################
- http://x1.#.lencr.org/
- http://www.te###young.eu/t.png
- http://www.te###young.eu/thumbs/freeteenporn.eu_tmp_1.jpg
- http://www.te###young.eu/thumbs/xfreehd.eu_tmp_1.jpg
- http://www.te###young.eu/thumbs/hdpornmax.eu_tmp_1.jpg
- http://www.te###young.eu/thumbs/sexfairynudes.eu_tmp_1.jpg
- http://www.te###young.eu/thumbs/xxxmov.eu_tmp_1.jpg
- http://www.po###tube.eu/?re##
- http://www.te###young.eu/thumbs/xvidzz.eu_tmp_1.jpg
- http://www.te###young.eu/thumbs/homepornking.eu_tmp_1.jpg
- http://www.te###young.eu/js/theme2/jquery.min.js
- http://www.te###young.eu/thumbs/xxxtubevideos.eu_tmp_1.jpg
- http://www.te###young.eu/thumbs/porn300.eu_tmp_1.jpg
- http://www.te###young.eu/ru/
- http://www.te###young.eu/font/theme2/fonts/fontawesome-webfont.eot?
- http://fo###.gstatic.com/s/chakrapetch/v9/cIf6MapbsEk7TDLdtEz1BwkWn6pk.eot
- http://www.te###young.eu/font/theme2/css/font-awesome.css
- http://www.te###young.eu/css/theme2/styles.css
- http://fo###.#oogleapis.com/css?fa#################
- http://www.te###young.eu/ru/?re##
- http://www.te###young.eu/?re##
- http://www.po###tube.eu/css/theme3/fontawesome-all.min.css
- http://www.po###tube.eu/css/theme3/style2.css
- http://www.te###young.eu/thumbs/porn69teen.eu_tmp_1.jpg
- http://sh###per.org/jfbx.cgi?12
- http://tu###ideo.eu/yapwoy.cgi?2&###############################
- http://tu###ideo.eu/nvcttrloc.cgi?2&##################################################
- http://tu###ideo.eu/agvv2.html
- http://se##top.eu/favicon.ico
- http://se##top.eu/go.php?u=####################################################################################
- http://tu###ideo.eu/ojaftz11.html
- http://www.te###young.eu/js/theme2/main.js
- http://www.te###young.eu/thumbs/bestteen.eu_tmp_1.jpg
Other
- 'a.###lsrv.com':443
UDP
- DNS ASK tu###ideo.eu
- DNS ASK se##top.eu
- DNS ASK po##otop.eu
- DNS ASK sh###per.org
- DNS ASK po###tube.eu
- DNS ASK a.###lsrv.com
- DNS ASK te###young.eu
- DNS ASK fo###.#oogleapis.com
- DNS ASK fo###.gstatic.com
- DNS ASK x1.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
